Comment by ahmadyan

6 hours ago

i think xai is now in pure damage control mode, after they caught exfiltrating data from users.

- There is a huge difference between logging user queries (which would include only the portion the model is reading) and exfiltrating user data (including env files, entire source code etc) which is what grok-build did here (https://github.com/xai-org/grok-build/blob/main/crates/codeg...). I would stay away from this open-source malware with a 10ft pole.

- if you like grok-4.5 model (it is a good model), i suggest use the model directly via API, or use Grok's oauth tokens if you are using supergrok+heavy subscriptions and connect it to your own agent.

30 comments

ahmadyan

Reply
bobsomers  6 hours ago

And for generating an absolutely gargantuan amount of CSAM and non-consensual sexualized images, but yeah, exfiltrating data too.

  • dijit  6 hours ago

    If I use a shovel to kill a man, the shovel maker did not engage in intentionally crafting a weapon of war.

    How tools are used are a reflection of the people who use them, and I definitely sympathise that tools should have guardrails to not enable this, or at least detect it.

    But if a pedophile uses Whatsapp to groom a child; I don't go after Whatsapp for being a neutral service... I go after the pedophile.

    • afavour  5 hours ago

      Just as well Grok isn’t a shovel then, hey?

      If a shovel manufacturer was notified numerous times that their shovel was being used for murder and they had the capability to disable using the shovel for murder while retaining all legitimate uses wouldn’t people question why they didn’t do it?

      5 replies →

    • solumunus  5 hours ago

      If WhatsApp knew their platform was facilitating CSAM, and they were fully within their power to prevent this but chose not to - yes this would rightly draw criticism…

      1 reply →

    • jazzpush2  6 hours ago

      Ok, but what if all Whatsapp competitors explicitly banned the ability to groom children on their platform, but Whataspp didn't, and directly advertised it.

      4 replies →

  • blizzard_dev_17  5 hours ago

    [flagged]

    • jdiff  4 hours ago

      No other model is so easy to generate such things. No model is so negligent in adding safeguards. I've seen it generate such things in response to a post that was clearly labeled as a 4th grader. The person you are talking to is responding to instances like that. They're not asking for it, that's obnoxiously silly and disingenuous.

m4rtink  3 hours ago

How can an AI agent, that is usually running on some machine in the cloud, even run without actually pulling in the data into the cloud to work with it ?

Is there an idea some sort of fixed localy running code does filtering on the data before it is sent to cloud?

Still seems like it would not work very well if it actually did any safe filtering - as the model can't "think" without seeing the data and it won't see the data unless the data is loaded to cloud.

lifthrasiir  6 hours ago

> exfiltrating user data (including env files, entire source code etc) which is what grok-build did here

I think env files are filtered out [1]. Anyway, the most suspicious code would be `upload_session_state` which is currently a stub function, though it is hard to say if it was only planned (badly) or has been removed as a damage control.

[1] https://github.com/xai-org/grok-build/blob/c1b5909ec707c069f...